Document/Allow adjustable session timeout or persistence

[ericwong3]

For the admin backend, there is currently no mention of what is the default timeout setting (e.g., is it browser session or is it some number of days), and there is a always a prompt which allows the user to persist the session for a hardcoded 2 months, which would be generally too long for any infrastructure components)

We should at least add the following:

• Document the default session behavior (i.e., browser session, allows remembering for 2 months)
• Allow adjusting the max duration (in case the browser never closes)
• Allow adjusting the persistence duration
• Allow disabling persistence

[willpower232]

I can't quickly find much documentation on the matter but it looks like you just need to update this file so would be interesting to see a PR

https://github.com/postalserver/postal/blob/main/config/initializers/session_store.rb

I don't know if the defaults are secure or not so would be good for someone who knows more about ruby on rails to chip in

[ericwong3]

Not a Ruby or RoR developer, but I think there is more than that. While this files controls the session expiry, there are definitely other places as well, for example https://github.com/postalserver/postal/blob/main/app/views/layouts/application.html.haml#L14 shows a popup/flash for user to Remember me, some conditions need to be added so the popup is not shown if persistence is disabled in YAML.